What’s Vulnerable › Vulnerabilities

CVE-2025-9223: Command Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-11 · updated 2026-09-26
• Weakness: CWE-77

Description

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

Affected products

• Zohocorp ManageEngine Applications Manager: before 178200 — fixed in 178200

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine Applications Manager 178200. Check the vendor advisory for mitigations.

References

• https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-9223.html

Get alerted when CVE-2025-9223 or the next vulnerability affects your stack